Analysis Overview
Threat Level: Shows suspicious behavior
The file https://www.mediafire.com/file/243j45m97m0pb3w/Silver+Rat+[Re+Lab].7z/file was found to be: Shows suspicious behavior.
Malicious Activity Summary
Executes dropped EXE
Obfuscated with Agile.Net obfuscator
Loads dropped DLL
System Location Discovery: System Language Discovery
Browser Information Discovery
Suspicious behavior: GetForegroundWindowSpam
Enumerates system info in registry
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Modifies registry class
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-18 01:49
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-18 01:49
Reported
2025-01-18 01:53
Platform
win10v2004-20241007-en
Max time kernel
231s
Max time network
203s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Browser Information Discovery
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeRestorePrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: 35 | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/243j45m97m0pb3w/Silver+Rat+[Re+Lab].7z/file
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe662046f8,0x7ffe66204708,0x7ffe66204718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6032 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,4191782814280175142,1316780477187414666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe
"C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"
C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.mediafire.com | udp |
| US | 104.17.151.117:443 | www.mediafire.com | tcp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.129.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.151.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.98.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | the.gatekeeperconsent.com | udp |
| US | 172.67.199.186:443 | the.gatekeeperconsent.com | tcp |
| US | 8.8.8.8:53 | static.mediafire.com | udp |
| US | 8.8.8.8:53 | privacy.gatekeeperconsent.com | udp |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 8.8.8.8:53 | sandbox.mediafire.com | udp |
| US | 172.67.199.186:443 | privacy.gatekeeperconsent.com | tcp |
| US | 104.16.80.73:443 | static.cloudflareinsights.com | tcp |
| NL | 18.239.18.117:443 | cdn.amplitude.com | tcp |
| US | 8.8.8.8:53 | cdn.otnolatrnup.com | udp |
| US | 104.19.208.227:443 | cdn.otnolatrnup.com | tcp |
| US | 8.8.8.8:53 | crt.rootg2.amazontrust.com | udp |
| NL | 18.239.83.86:80 | crt.rootg2.amazontrust.com | tcp |
| US | 8.8.8.8:53 | 72.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 186.199.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.80.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.18.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.208.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.83.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | otnolatrnup.com | udp |
| US | 8.8.8.8:53 | api.amplitude.com | udp |
| US | 52.11.54.201:443 | api.amplitude.com | tcp |
| US | 8.8.8.8:53 | www.mediafiredls.com | udp |
| US | 8.8.8.8:53 | tags.crwdcntrl.net | udp |
| US | 8.8.8.8:53 | ad.crwdcntrl.net | udp |
| US | 8.8.8.8:53 | bcp.crwdcntrl.net | udp |
| US | 104.26.2.173:443 | www.mediafiredls.com | tcp |
| IE | 34.248.19.126:443 | bcp.crwdcntrl.net | tcp |
| NL | 18.239.18.78:443 | tags.crwdcntrl.net | tcp |
| IE | 34.248.19.126:443 | bcp.crwdcntrl.net | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 173.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.18.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.39.65.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.19.248.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.54.11.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | region1.analytics.google.com | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | g.ezoic.net | udp |
| US | 8.8.8.8:53 | www.google.co.uk | udp |
| US | 216.239.34.36:443 | region1.analytics.google.com | tcp |
| GB | 172.217.169.3:443 | www.google.co.uk | tcp |
| FR | 13.37.187.223:443 | g.ezoic.net | tcp |
| BE | 64.233.184.156:443 | stats.g.doubleclick.net | tcp |
| US | 8.8.8.8:53 | 3.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.34.239.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.184.233.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.187.37.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | download1528.mediafire.com | udp |
| US | 205.196.123.216:443 | download1528.mediafire.com | tcp |
| US | 205.196.123.216:443 | download1528.mediafire.com | tcp |
| US | 104.19.208.227:80 | otnolatrnup.com | tcp |
| US | 104.19.208.227:80 | otnolatrnup.com | tcp |
| US | 8.8.8.8:53 | 216.123.196.205.in-addr.arpa | udp |
| US | 8.8.8.8:53 | woreppercomming.com | udp |
| NL | 13.227.219.83:443 | woreppercomming.com | tcp |
| US | 8.8.8.8:53 | www.chancial.com | udp |
| US | 104.21.79.34:443 | www.chancial.com | tcp |
| US | 8.8.8.8:53 | www.opera.com | udp |
| DE | 3.125.169.155:443 | www.opera.com | tcp |
| US | 8.8.8.8:53 | cdn-production-opera-website.operacdn.com | udp |
| US | 8.8.8.8:53 | www.googleoptimize.com | udp |
| US | 8.8.8.8:53 | 83.219.227.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.79.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.169.125.3.in-addr.arpa | udp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| GB | 216.58.204.78:443 | www.googleoptimize.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| DE | 23.218.169.21:443 | cdn-production-opera-website.operacdn.com | tcp |
| US | 8.8.8.8:53 | 78.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.169.218.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.187.250.142.in-addr.arpa | udp |
| US | 216.239.34.36:443 | region1.analytics.google.com | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.202.48.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.129.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 36988ca14952e1848e81a959880ea217 |
| SHA1 | a0482ef725657760502c2d1a5abe0bb37aebaadb |
| SHA256 | d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6 |
| SHA512 | d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173 |
\??\pipe\LOCAL\crashpad_3916_QCIMBJFPIDNVTSJW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | fab8d8d865e33fe195732aa7dcb91c30 |
| SHA1 | 2637e832f38acc70af3e511f5eba80fbd7461f2c |
| SHA256 | 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea |
| SHA512 | 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 69b0e05f0386985ed4c24d5bc616988f |
| SHA1 | 185328b7f1cc0cfb61b5f7dd1f78dad6f56517bf |
| SHA256 | f04fe9f3219ed99557e20c38c1b64cb9eaf446e803fcdf9dfdf17f861b76cf4b |
| SHA512 | ec5a3dbb43939df03f7f742b85ae8b2af93fa0016336ae5c405087711ec6874b94b00c742676d238ec4ef14c1b1a29cdcfae973025eaa1f788dc1c9e19e12878 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | c81b33272f700411fadf3e32529a95a8 |
| SHA1 | 47a9ca1d9b89a9b1c1436a9e7da11494c7676ba0 |
| SHA256 | 0c84055ddf9a4dfe050cd19d26038f5836475558de429274e7d194e00cfd0da6 |
| SHA512 | 139985591b1adb1ae3c64e2d6be078b89a76f282c613e1c5ead5b5658a083d6b90287c19a3919c4e5cacf4cae91d6c931e7b6b8fced2dc722c9b50e25c6b7286 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2b68ee818ca4e211795637e257d71e1c |
| SHA1 | 0efe089b12556c7cf0f105ed25beada842b842ee |
| SHA256 | 26c8989034084b524ba794073ca497ead312bd973bac604148a40abfd292fe1d |
| SHA512 | 1b1a91bfc296b0882d909dcce4d56205617ffb83e5b4b41f4537a8fe53e78d1e142cd5aae2b6875866a83851041180eeaca4ab324c0ceb762441684e8594aad0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 69cd6a3050537d04fdbdba6215ed7bb2 |
| SHA1 | 0f5457450bf05c839dcda3ed81ae5dc22a927b1b |
| SHA256 | 4ce8d9753cffab1577b72186df0def76d6645bed72f587e48f7cd888d0e37a8a |
| SHA512 | 4a4e66b81a1c2c11f88178d9b4ae313e20ae97f71e6284828fb38e4bce876b00415e67f3e454d7c7718aa53030686d8bdf2f9ad209f3f565a5d21ac35b6e42da |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 44b75284f60fabda0099c494f9b11acc |
| SHA1 | a25bb8b9435902aaa8aed5ba6c036a38c63842b8 |
| SHA256 | f32db842207e0323fd3ed1bf61fcd47c901d7efa06e6666e6a6aecba8e2230e0 |
| SHA512 | b2462ab37c031a477b928a1932ea437d5a9155adc33101d168732a8a24c9997d538ffdaaaad7a85d4f66107d767761ca2904d899f1fec14ae9372713c0531b30 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d08e.TMP
| MD5 | 2ea3f4922e5b48783a277c1014619836 |
| SHA1 | 3cf5c6804dde66e7bff9821d1f45f700d0bcea3f |
| SHA256 | d20cd35d3c6d168134a07a125083616693090b7d0aa06088f093d80be0aa1af9 |
| SHA512 | c32ca3bb2319d32d1058b011bdc8843e691f01162dc830a641dc43980808610f603d939860da48c1dfae02c8134a640d4fd8e1614227fa1553e42f12d97b8e41 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5f4b59828e2050ad923d91297c85720e |
| SHA1 | 2bdc2c5b3dd714cde8ce7df08ee7f3bba56aacff |
| SHA256 | 97e736df16ec91a9c52cbd4aa9198856d98129e78b18b98679b8665251fefd42 |
| SHA512 | 3f0b18d73cb4df75c2b99b7e6fb83e1053bccd065867eec5ad2bc17a852e21f52799072f8e8bd5989c5bf0071c5f99cb4399e66049125dbd79372bd7b0b0172b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 58c395593ac9c4746d208fb62c9c0e49 |
| SHA1 | c5487923bc895720fea432407b65f83f1fa19e12 |
| SHA256 | 8e484bf1ec4dfea70620406b003bfac33a0324a0e01ab8763149e301217fe59a |
| SHA512 | 95fffa534e0e7549445dd73929b77ceaa1188bd27c217c3c3e3e67db2cf61063e706d0c981204eebc2e3cd972c757fda79e3385cbadab5c602eae5ee9bd387b0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 655fb579fa835187b16f726e22fd3312 |
| SHA1 | ca26f60fa88a3d96670d9a4dd73c9de24e712821 |
| SHA256 | 4d2dda53faab5f08a65a5267e9a35a53c076420e667c3be126ac60403121d2b3 |
| SHA512 | 39ca1505546d9c7001b241849f7b76b62b3ff3c0d39d448a48b5f754a03339367aedef64c8e33a5cbe301843273ff579e0fb1f0334224f4d80b1b777225267c1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 737e483c3e7d81d4f9d21eb0f0ad35b7 |
| SHA1 | 389bef6e2b4debd086785714951c5bc5cdb74290 |
| SHA256 | 5976da811f23511687df1080a94b2609e195472ad8ea5651b11ebeffbd571a0a |
| SHA512 | 5d601863979cdd3357880f2c11d67f1ec6e4065b0a7de67b0066269447bc3639ff9ccb2fc61b0e328d86f1069b69432946f0c6db1b0e6e01349d9098ea2aeb22 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 11b77882314502ac9b15a105eac36863 |
| SHA1 | 1032aefc60cfba2552a2360ffe103a67c0b5ad1d |
| SHA256 | 5cb535e1d99b3a506bdb70cbb0f125172f9f51abc13c291fe94ccf21fe620411 |
| SHA512 | da3a3269397e6e9d525549c6151345ba2a497ee412f731b8d9cb8287fdba938e5605ba02fecc730639d702a5d26ed891858c0b8958f34a37bb7c0df4d488fcfc |
C:\Users\Admin\Downloads\Silver Rat [Re Lab].7z
| MD5 | f06813aa321c43a69a04904cfa735a44 |
| SHA1 | 820a0f9f4c00af6ce2583218019ad14a5c5592e2 |
| SHA256 | a384bad25740a4b783eaadd6ade53d96e878e1313c34321ddfb23149fbf6366d |
| SHA512 | 72551e22ba2db4759ad905f92f407f7e8266e363aa8627a56d8bcaea83a69a96466269358a034e626581f24c2417fa98bb0bb57472f96c2ea39b2708edaa5bb8 |
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe
| MD5 | d6527f7d5f5152c3f5fff6786e5c1606 |
| SHA1 | e8da82b4a3d2b6bee04236162e5e46e636310ec6 |
| SHA256 | 79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9 |
| SHA512 | 2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f |
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe.config
| MD5 | d6f1152d647b57f64494c3e1d32ede94 |
| SHA1 | a35bd77be82c79a034660df07270467ee109f5ac |
| SHA256 | a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72 |
| SHA512 | 699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd |
memory/3124-380-0x0000000000410000-0x0000000001D3E000-memory.dmp
memory/3124-381-0x0000000006DE0000-0x0000000007384000-memory.dmp
memory/3124-382-0x0000000006760000-0x00000000067F2000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Guna.UI2.dll
| MD5 | acec68d05e0b9b6c34a24da530dc07b2 |
| SHA1 | 015eb32aad6f5309296c3a88f0c5ab1ba451d41e |
| SHA256 | bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277 |
| SHA512 | d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700 |
memory/3124-386-0x0000000006B00000-0x0000000006C76000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.UI.WinForms.dll
| MD5 | 686833fccd95b4f5c8d7695a2d45955d |
| SHA1 | 882f60ea47f536c1f01da0f5767dfe5d569fc011 |
| SHA256 | 578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2 |
| SHA512 | 8bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1 |
memory/3124-390-0x00000000075E0000-0x0000000007730000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.UI.WinForms.1.5.3.dll
| MD5 | c1d51a0e747c9d6156410cb3c5b97a60 |
| SHA1 | 86312cba2eb3495cc6bec66d54d4ab88596275d8 |
| SHA256 | 6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a |
| SHA512 | a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222 |
memory/3124-394-0x00000000074E0000-0x000000000752E000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\cGeoIp.dll
| MD5 | 6d6e172e7965d1250a4a6f8a0513aa9f |
| SHA1 | b0fd4f64e837f48682874251c93258ee2cbcad2b |
| SHA256 | d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0 |
| SHA512 | 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155 |
memory/3124-398-0x0000000007A50000-0x0000000007CA2000-memory.dmp
memory/3124-399-0x00000000078B0000-0x00000000078BA000-memory.dmp
memory/3124-400-0x0000000007A00000-0x0000000007A32000-memory.dmp
memory/3124-401-0x0000000008AE0000-0x0000000008B7C000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.Licensing.dll
| MD5 | c18a9e44e200c7315a1868caab894293 |
| SHA1 | 18f65508762d2492f41b22e4e6e5ad19a2226baa |
| SHA256 | 661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22 |
| SHA512 | 9a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1 |
memory/3124-405-0x0000000008FF0000-0x000000000913E000-memory.dmp
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\SocketPort.xml
| MD5 | 5f807862258a390b2e2f75abb6d2c865 |
| SHA1 | 22abc144aa034c6490cbf143a8f1cdd42bd06d1b |
| SHA256 | 7b87c31f6d1163fc236651f5e1f3187cfa0c79d4a85d20c1c05f1dc3056c4823 |
| SHA512 | b831e4b2eeec23e39544961cef6619c8d57c50b53dc6bad8846682df6f5252041f50ce33cbe182488288d6d5e2e3e5194055ee4143ceb09f9601ed49d39dba39 |
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\Builder.xml
| MD5 | 3fcd4ac4720febae7ed0b81913daaf1c |
| SHA1 | 7d2ec4090023cc93a453c65782c78fe9bcf5afbd |
| SHA256 | b4b7d0f7878a60e5d641443a7d4720e178568e6febbb38a243d3b9fb8a30842b |
| SHA512 | c6a5c5c5d17d2e56fd2fde8705062a8916673ec5557ef9f30c9f62c67877c72f5b8e4528a3a8a8ec24f74e5c52ed385442483606b13972bcc645257a5826f2ca |
C:\Users\Admin\AppData\Local\Temp\Tmp1648.tmp
| MD5 | e1a48ec781542ab4f0d3a3368b2a1d05 |
| SHA1 | a35670f07e5320a1591a55d903b35dcdd1d224a1 |
| SHA256 | f41d8818774f3ec0bf936e564f50008b46f5e4060edaab3bd72ffa389fb9ef21 |
| SHA512 | d3e756d8b321d38962a7b36af617d152e9bfd499b31f1630a24ada435715ad81a29ab73e4ab4aa21bbc9029b4177a943303e7df922bf375c2583607cb6f6566a |